Article Details
Scrape Timestamp (UTC): 2024-10-16 05:08:18.037
Source: https://thehackernews.com/2024/10/github-patches-critical-flaw-in.html
Original Article Text
Click to Toggle View
GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access. GitHub has released security updates for Enterprise Server (GHES) to address multiple issues, including a critical bug that could allow unauthorized access to an instance. The vulnerability, tracked as CVE-2024-9487, carries a CVS score of 9.5 out of a maximum of 10.0 "An attacker could bypass SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, allowing unauthorized provisioning of users and access to the instance, by exploiting an improper verification of cryptographic signatures vulnerability in GitHub Enterprise Server," GitHub said in an alert. The Microsoft-owned company characterized the flaw as a regression that was introduced as part of follow-up remediation from CVE-2024-4985 (CVSS score: 10.0), a maximum severity vulnerability that was patched back in May 2024. Also fixed by GitHub are two other shortcomings - All three security vulnerabilities have been addressed in Enterprise Server versions 3.14.2, 3.13.5, 3.12.10, and 3.11.16. Back in August, GitHub also patched a critical security defect (CVE-2024-6800, CVSS score: 9.5) that could be abused to gain site administrator privileges. Organizations that are running a vulnerable self-hosted version of GHES are highly advised to update to the latest version to safeguard against potential security threats.
Daily Brief Summary
GitHub has issued security updates for its Enterprise Server to tackle multiple vulnerabilities, including a critical flaw.
The critical vulnerability, identified as CVE-2024-9487, allows unauthorized access and user provisioning via a SAML SSO bypass.
This flaw has a CVSS score of 9.5, indicating its severity.
The issue was inadvertently introduced during the remediation of a previous vulnerability, CVE-2024-4985, which also had a high severity level.
Alongside CVE-2024-9487, GitHub corrected two additional security issues in the latest server versions.
Recommended action for organizations is to urgently update their self-hosted GitHub Enterprise Server to the latest version to mitigate risks.
This update follows a pattern of critical fixes by GitHub, reflecting ongoing efforts to secure its systems against sophisticated threats.